MCP Server VPC — private subnets, security groups, NAT gateway, VPC endpoints

Subnet layout and routing

The standard MCP server VPC layout uses two tiers: public subnets for the ALB and NAT gateways, private subnets for ECS tasks (and optionally RDS/ElastiCache). Traffic flows inbound through the ALB and outbound through the NAT gateway or VPC endpoints.

// CDK: VPC with public and private subnets across 2 AZs
import * as ec2 from "aws-cdk-lib/aws-ec2";

const vpc = new ec2.Vpc(this, "McpVpc", {
  maxAzs: 2,
  natGateways: 1,       // single NAT gateway: lower cost, less HA
  // natGateways: 2,    // one per AZ: true HA but $0.045/hr per gateway
  subnetConfiguration: [
    {
      name: "Public",
      subnetType: ec2.SubnetType.PUBLIC,
      cidrMask: 24,
    },
    {
      name: "Private",
      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
      cidrMask: 24,
    },
  ],
  enableDnsHostnames: true,   // required for Interface VPC endpoint private DNS
  enableDnsSupport: true,     // required for VPC DNS resolver
});

// ECS cluster uses private subnets
const cluster = new ecs.Cluster(this, "McpCluster", { vpc });

// ECS service network configuration — private subnets only
const service = new ecs.FargateService(this, "McpService", {
  cluster,
  taskDefinition,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
  assignPublicIp: false,   // tasks in private subnets must not have public IPs
});

NAT gateway cost: a single NAT gateway costs $0.045/hr (~$32/month) plus $0.045/GB of data processed. If your ECS tasks make frequent large AWS API calls or pull images often, VPC endpoints can eliminate the majority of that data-processing charge.

Security group chain

The security group design for an MCP server follows a chain: the ALB accepts public HTTPS traffic, and the ECS task accepts traffic only from the ALB security group. No other inbound traffic reaches the task.

// CDK: security group chain
const albSg = new ec2.SecurityGroup(this, "AlbSg", {
  vpc,
  description: "ALB: public HTTPS",
  allowAllOutbound: false,
});
albSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), "HTTPS from internet");
albSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), "HTTP redirect");

const taskSg = new ec2.SecurityGroup(this, "TaskSg", {
  vpc,
  description: "ECS task: accepts traffic from ALB only",
  allowAllOutbound: true,    // tasks need outbound for ECR pull, SSM, Secrets Manager
});
taskSg.addIngressRule(albSg, ec2.Port.tcp(3000), "ALB to MCP container");

// Allow ALB to reach tasks
albSg.addEgressRule(taskSg, ec2.Port.tcp(3000), "ALB to MCP task");

VPC endpoints: eliminate NAT gateway charges for AWS API calls

Every AWS API call from a task in a private subnet — ECR image pull, SSM parameter fetch, Secrets Manager read, CloudWatch log write — routes through the NAT gateway and incurs $0.045/GB data-processing charge. Interface VPC endpoints create a private link to the service endpoint directly inside the VPC, bypassing the NAT gateway and eliminating the data-processing charge for those calls.

// CDK: VPC endpoints for ECR, SSM, Secrets Manager, CloudWatch Logs
const endpointSg = new ec2.SecurityGroup(this, "EndpointSg", {
  vpc,
  description: "VPC Interface endpoints",
  allowAllOutbound: false,
});
endpointSg.addIngressRule(taskSg, ec2.Port.tcp(443), "tasks to endpoints");

// S3 Gateway endpoint (free — no hourly charge)
vpc.addGatewayEndpoint("S3Endpoint", {
  service: ec2.GatewayVpcEndpointAwsService.S3,
});

// Interface endpoints ($0.01/hr each + $0.01/GB)
for (const [id, service] of Object.entries({
  EcrApi:         ec2.InterfaceVpcEndpointAwsService.ECR,
  EcrDkr:         ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,
  Ssm:            ec2.InterfaceVpcEndpointAwsService.SSM,
  SecretsManager: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
  Logs:           ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS,
})) {
  new ec2.InterfaceVpcEndpoint(this, id + "Endpoint", {
    vpc,
    service,
    subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
    securityGroups: [endpointSg],
    privateDnsEnabled: true,   // overrides public DNS — SDK calls route to endpoint automatically
  });
}

Cost note: each Interface endpoint costs $0.01/hr (~$7.20/month) plus $0.01/GB. Five Interface endpoints cost ~$36/month but can save more than that if your tasks make frequent AWS API calls or pull images on every deploy. Profile before adding all five — start with ECR and SSM, which typically carry the most traffic.

Common failure modes